The European Commission's Action Plan on Cybersecurity and Artificial Intelligence, presented on 7 July 2026, formalises a €300 million investment programme and activates a Union-wide AI model evaluation mandate scheduled for operational status by 2027 — placing concrete compliance obligations on every organisation deploying advanced AI across the EU's critical infrastructure sectors.
For readers who want to go deeper, Grace Certified offers AI governance hygiene checklists.
What the Action Plan mandates
The Action Plan structures its regulatory programme across three complementary pillars: promoting safe and responsible use of advanced AI models; reinforcing EU cybersecurity and operational resilience; and scaling European AI capabilities for defensive cybersecurity applications. These pillars consolidate obligations drawn from four existing legal instruments — the AI Act, the Cyber Resilience Act, the NIS2 Directive, and the Digital Operational Resilience Act (DORA) — into a single execution framework with defined milestones and investment commitments running through end of 2027.
The centrepiece of the plan is the establishment of a European AI evaluation capability covering cybersecurity, targeted for operational status by 2027. This capability equips the AI Office to conduct third-party assessments of frontier and general-purpose AI (GPAI) models before they reach the EU market — extending Chapter V AI Act obligations on GPAI providers into a dedicated cybersecurity evaluation track. Providers placing advanced AI on the EU market face assessment covering both systemic risk classification and cybersecurity-specific risk factors, two dimensions that previously operated as parallel regulatory tracks and now converge under a single competent authority.
The Action Plan further directs the EU Agency for Cybersecurity (ENISA), working alongside the Joint Research Centre (JRC), to deliver two concrete infrastructure elements. First, a European Blueprint for structured access to advanced AI systems, defining which categories of actor — EU institutions, Member States, critical infrastructure operators, cybersecurity providers, and research entities — receive authorised access to frontier AI capabilities for defensive purposes. Second, a secure testing platform that allows critical-sector operators to deploy and stress-test AI solutions against simulated attack scenarios under controlled conditions.
An Open Source Software Resilience Campaign launches in Q3 2026, targeting security vulnerabilities in AI toolchains and cybersecurity software reliant on open-source components. The campaign engages public agencies, private developers, and research communities to identify and remediate high-risk dependencies across the EU's critical digital supply chain — a direct complement to the Cyber Resilience Act's software component obligations.
The EU Grand Challenge on AI for Cybersecurity will mobilise companies, research institutions, and public organisations around developing sovereign EU-built defensive AI solutions, with technical specifications aligned to the Action Plan's three pillars. Details on eligibility and submission timelines follow the Action Plan's formal adoption track.
Who must act and by when
Four categories of organisation carry material compliance obligations under the Action Plan's integrated timeline.
AI model providers face heightened regulatory scrutiny from 2 August 2026, the date on which AI Act supervisory powers reach full operational effect. Providers of advanced or GPAI models with cybersecurity risk implications enter the queue for the forthcoming 2027 evaluation framework; those that proactively engage the AI Office's regulatory function gain early dialogue over classification methodology before formal assessment cycles commence. The Action Plan makes clear that the evaluation capacity being built toward 2027 will assess both systemic risk and cybersecurity risk vectors as a combined obligation — closing the gap between Chapter V systemic risk review and the new cybersecurity risk assessment track.
Critical infrastructure operators across energy, transport, health, finance, and public administration receive explicit guidance to intensify cyber hygiene programmes, integrate AI-assisted vulnerability management into operational security workflows, and register for access to ENISA's secure testing platform once available. These operators sit at the documented intersection of NIS2 obligations and AI Act Article 6 high-risk classifications — the Action Plan formalises that intersection and establishes accountability structures around it.
Cybersecurity startups and scale-ups gain access to €100 million in EIC Fund investments by end of 2026, targeted at AI-native security solutions. Eligibility criteria align with the EU Grand Challenge framework. Separately, €200 million in Horizon Europe and Digital Europe programme funding flows to research organisations and AI Factories developing responsible AI infrastructure and contributing to the 2027 evaluation architecture through the current Multiannual Financial Framework.
Financial sector entities carrying DORA obligations face the same 2027 deadline convergence as general critical infrastructure operators: NIS2, DORA, and the incoming Cyber Resilience Act all reach implementation maturity in the same window as the EU evaluation capability becomes operational. Early compliance mapping that spans all three instruments reduces the risk of duplicated remediation programmes and conflicting internal accountability timelines.
The board-level decision
Boards and General Counsel should direct a formal AI-cybersecurity compliance mapping exercise to complete by Q4 2026. The output: a structured register cross-referencing each active AI deployment against its obligations under the AI Act (Chapter V for GPAI models, Article 6 for high-risk AI systems), NIS2, DORA, and the Cyber Resilience Act, with named accountability owners for each compliance stream. This register becomes the primary internal document for regulator engagement when the 2027 evaluation cycle opens — and positions the organisation to participate constructively in ENISA's Blueprint access process rather than facing retrospective disclosure requests. The AI Act's supervisory powers activate on 2 August 2026: that date is the hard start for board-level accountability on GPAI model governance.
Article by ATLAS — Governance & Compliance
ATLAS covers AI regulation from primary legal sources. Every obligation cited to the official document.